隐形墨水：浏览器和电子邮件中 ​​CSS 的隐私风险.pdf

1、#BHAS BlackHatEventsInvisible InkPrivacy Risks of CSS on the Web and in EmailsLeon Trampert,Daniel WeberInvisible Ink#BHAS BlackHatEventsMotivation2!Invisible Ink#BHAS BlackHatEventsEmail Forward Detection3For AliceInvisible Ink#BHAS BlackHatEventsHidden Phishing Emails4Update Powerpoint hereRegular

2、 EmailInvisible Ink#BHAS BlackHatEventsAgenda5Email ClientFingerprintingCSS-basedBrowserFingerprintingUse CasesInvisible Ink#BHAS BlackHatEvents$whoami-Leon TrampertPhD Student CISPA Helmholtz Center for Information SecurityFocus on-Browser Security-Side-Channel AttacksContactleon.trampert.meltrampe

3、rt6Invisible Ink#BHAS BlackHatEvents$whoami-Daniel WeberPhD Student CISPA Helmholtz Center for Information SecurityFocus on-CPU Security-Side-Channel AttacksContactd-we.meweber_daniel7Invisible Ink#BHAS BlackHatEventsBrowser Fingerprinting8Invisible Ink#BHAS BlackHatEventsWhat Is Browser Fingerprint

4、ing?Link Usersand Devices9Identify UsersLink SessionsInvisible Ink#BHAS BlackHatEventsThe Good Risk-Based Authentication10B0BInvisible Ink#BHAS BlackHatEventsThe Good Risk-Based Authentication11DEADInvisible Ink#BHAS BlackHatEventsExample Notification12Invisible Ink#BHAS BlackHatEventsThe Bad User-S

5、pecific Web Content13A11CEInvisible Ink#BHAS BlackHatEventsThe Bad User-Specific Web Content14Invisible Ink#BHAS BlackHatEventsThe Ugly Hiding Malicious Content15A11CEInvisible Ink#BHAS BlackHatEventsThe Ugly Hiding Malicious Content16B0BInvisible Ink#BHAS BlackHatEventsThe Ugly Hiding Malicious Con

6、tent17Invisible Ink#BHAS BlackHatEvents18How DoesFingerprinting Work?Invisible Ink#BHAS BlackHatEvents19Browser FingerprintingIP:100.8.8.137User-Agent:Mozilla/5.0(Android 15;Mobile;rv:136.0)Gecko/136.0 Firefox/136.0Accept-Language:de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7IP AddressUser-Agent HeaderLanguag